Express

Encrypt a .env file in Express with the Dotenvx Node.js SDK, commit it safely, and load its secrets at runtime.

Prerequisites

Install

In your Express project, install Dotenvx.

$ npm install @dotenvx/dotenvx

$ pnpm add @dotenvx/dotenvx

Encrypt

Start with a secret value in the .env file at your project root, like:

# .env
HELLO="Secret"

Encrypt it with a single command.

$ npx dotenvx encrypt
◈ encrypted .env (022 0D8) via .env.keys ⛉

$ pnpm exec dotenvx encrypt
◈ encrypted .env (022 0D8) via .env.keys ⛉

The values become ciphertext and only your private key can unlock them.

# .env
DOTENV_PUBLIC_KEY="0220d830351410598be484f43a7b07097e09851f50426832876e8b5815a1752990"

HELLO="encrypted:BHLTACNJMr00nTG6yXpkCyWFKF/MY0ajN855tg3uVtKopTe2AGzSkQlcPd21pTOT3Ci8IKrdIg2TMZFoq1mDR6yb06QCRvqHXtpkZkAHYCEHfeWqqC8tMFovcYq5JS2uZSrC/qUGDA=="

Commit

Commit your encrypted .env files with your code. It's safe. Now you can securely share secrets through git.

$ git add .env
$ git commit -m "encrypt .env"

Ship

Read your secrets through process.env. Create index.js:

// index.js
require('@dotenvx/dotenvx').config()
const express = require('express')

const app = express()

app.get('/', (req, res) => {
  res.send(`Hello ${process.env.HELLO}`)
})

const port = process.env.PORT || 3000
app.listen(port, () => {
  console.log(`Server running on http://localhost:${port}`)
})

Add a start script to your package.json:

{
  "scripts": {
    "start": "node index.js"
  }
}

Run your app:

$ npm start
⟐ injected env (2) from .env (022 0D8) via .env.keys
Server running on http://localhost:3000

$ pnpm start
⟐ injected env (2) from .env (022 0D8) via .env.keys
Server running on http://localhost:3000

Dotenvx loads and decrypts .env before Express reads process.env.

Visit http://localhost:3000 to see Hello Secret.

Hello Secret

Have teammates? Share access with Dotenvx Armor ⛨

$ npx dotenvx login
◉ logged in (username)

$ pnpm exec dotenvx login
◉ logged in (username)

Create the Armored Key ⛨

$ npx dotenvx armor up
⛨ armored .env (022 0D8)

$ pnpm exec dotenvx armor up
⛨ armored .env (022 0D8)

Invite your teammate.

$ npx dotenvx armor invite
⛨ invited [email protected] to team

$ pnpm exec dotenvx armor invite
⛨ invited [email protected] to team

Your teammate accepts the invitation, pulls the repository, installs dependencies, and logs in with dotenvx login. They can then run the app:

$ npm start
⟐ injected env (2) from .env (022 0D8) via Armor ⛨
Server running on http://localhost:3000

$ pnpm start
⟐ injected env (2) from .env (022 0D8) via Armor ⛨
Server running on http://localhost:3000

Visit http://localhost:3000 to see Hello Secret.

Hello Secret

Share a private key Alternative →

Production

Create a .env.production file.

# .env.production
HELLO="Production"

Encrypt it with an Enclaved Key ◊

$ npx dotenvx encrypt -f .env.production
◈ encrypted .env.production (022 0D8) via Armor Enclave ◊

$ pnpm exec dotenvx encrypt -f .env.production
◈ encrypted .env.production (022 0D8) via Armor Enclave ◊

When prompted, choose Enclaved, select your deployment service, connection, and resource, and use DOTENV_PRIVATE_KEY_PRODUCTION as the private key name.

Commit .env.production.

$ git add -f .env.production
$ git commit -m "encrypt .env.production"

Deploy your code and encrypted .env.production file to the selected resource. Install your dependencies there:

$ npm install

$ pnpm install

Set DOTENV_FILE to .env.production in your deployment environment so Dotenvx knows which file to load. Keep .env.keys on your local machine.

Run your app:

$ npm start

$ pnpm start

Dotenvx loads and decrypts .env.production with your Enclaved Key ◊

Open your deployed app's URL to see Hello Production.

Hello Production

Deploy with a private key Alternative →

Conclusion

You've encrypted your secrets, shared access with Armor, and loaded production secrets in Express with an Enclaved Key. Your secrets now travel with your code.